CPA: The Complete Guide
The Colorado Privacy Act, signed into law in July 2021 and effective July 1, 2023, is one of the most consumer-friendly state privacy laws in the United States. It stands out for its requirement that businesses recognize universal opt-out mechanisms, making it easier for consumers to exercise their privacy preferences across multiple organizations simultaneously.
What the CPA Covers
The CPA grants Colorado consumers rights to access, correct, delete, and obtain a portable copy of their personal data. Consumers may also opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
A distinguishing feature of the CPA is its universal opt-out mechanism requirement. Controllers must recognize technology-enabled signals such as the Global Privacy Control (GPC) that communicate a consumer's opt-out preferences automatically.
The law requires purpose limitation and data minimization, restricting collection to what is reasonably necessary for specified purposes. Sensitive data — including racial or ethnic origin, health data, biometric identifiers, and precise geolocation — requires affirmative opt-in consent before processing.
Who Needs to Comply
The CPA applies to entities that conduct business in Colorado or intentionally target Colorado residents and either control or process the personal data of 100,000 or more Colorado consumers annually, or control or process the data of 25,000 or more consumers while deriving revenue or receiving a discount on goods or services from the sale of personal data.
The law exempts entities and data covered by HIPAA, GLBA, FERPA, and other federal frameworks. Nonprofits and higher education institutions are also excluded.
Enforcement
The Colorado Attorney General and district attorneys have exclusive enforcement authority. The initial 60-day cure period expired on January 1, 2025, after which regulators may pursue enforcement without offering a cure opportunity. Civil penalties are assessed under the Colorado Consumer Protection Act.
Practical Compliance Steps
- Universal opt-out — Implement recognition of GPC and other universal opt-out signals
- Consent management — Deploy opt-in mechanisms for sensitive data processing
- Consumer rights workflows — Build intake and fulfillment processes within 45-day deadlines
- Data protection assessments — Document assessments for targeted advertising, sale, profiling, and sensitive data processing
- Privacy notice updates — Disclose categories of data, purposes, rights, and opt-out methods